PenTest+ · Domain 5 of 5

PenTest+ Domain 5: Post-exploitation and Lateral Movement

Post-exploitation and Lateral Movement covers what happens after the first compromise: establishing persistence, moving through the network, staging and exfiltrating data covertly, and then cleaning up so the environment is returned to its original state.

Exam weight
14%
Official objectives
4
Estimated questions estimate
~13
Suggested study time estimate
15–20 hrs

About 12 min read Reviewed October 2026

Overview

Domain 5 covers the final phases of an engagement. It starts with establishing and maintaining persistence: scheduled tasks and cron jobs, service creation, reverse and bind shells, new accounts, valid credentials, registry keys, command-and-control (C2) frameworks, backdoors such as web shells and trojans, rootkits, browser extensions and tampering with security controls. It covers lateral movement: pivoting, relay creation, enumeration of services, traffic and credentials, service discovery across SMB, RDP, SSH, LDAP and more, WMI and WinRM, and tools such as LOLBins, Covenant, CrackMapExec, Impacket and Mimikatz. It covers staging and exfiltration: file encryption and compression, covert channels through steganography, DNS, ICMP and HTTPS, email, cloud storage and alternate data streams. It finishes with cleanup and restoration: removing persistence, reverting changes, removing tester-created credentials and tools, spinning down infrastructure, preserving artifacts and securely destroying data.

This domain closes the engagement responsibly, and the cleanup step is a professional and ethical obligation.

How it's tested

Questions describe a post-compromise situation and ask how to persist, how to move laterally, how to exfiltrate without detection, or what cleanup is required. The professional answer respects stealth during the test and a clean, documented handover at the end.

  • Persist or move

    A foothold is established, and you must choose the persistence mechanism or the lateral movement technique that fits the environment.

  • Covert channel

    Data must leave without tripping monitoring, and you must choose the exfiltration method that evades the controls described.

  • Clean up correctly

    The engagement is ending, and you must identify what must be removed, reverted or preserved.

Reasoning it through

A tester has compromised a workstation and wants to reach a database server that the workstation can talk to but the tester cannot reach directly. Attacking the database from the internet is impossible. The answer is pivoting: route traffic through the compromised workstation, using a tool such as Proxychains or an Impacket relay, so the tester reaches the internal server through the foothold.

Objectives 4

Official objectives from the CompTIA outline, in outline order.

5.1 Given a scenario, perform tasks to establish and maintain persistence.Scheduled tasks, services, shells, accounts, C2, backdoors and security-control tampering.
What it means
Persistence keeps access after the initial exploit, through scheduled tasks and cron jobs, service creation, reverse and bind shells, new accounts, obtaining valid credentials, registry keys, command-and-control (C2) frameworks, backdoors such as web shells and trojans, rootkits, browser extensions, and tampering with security controls.
What to understand
A reverse shell connects outward from the target to the tester, which usually bypasses inbound firewall rules, while a bind shell listens on the target and is easier to block. Valid credentials are the stealthiest persistence, since they look legitimate. Every persistence mechanism created must be documented so it can be removed during cleanup.
How it shows up
A foothold and an environment are described, and you must choose the persistence method, often a reverse shell when inbound connections are blocked.
Common confusion
Confusing reverse and bind shells. A reverse shell connects out from the target; a bind shell listens on the target for an inbound connection.
5.2 Given a scenario, perform tasks to move laterally throughout the environment.Pivoting, relay creation, enumeration, service discovery, WMI, WinRM and tools.
What it means
Lateral movement spreads access across the network through pivoting and relay creation, continued enumeration (service discovery, network traffic discovery, additional credential capture, credential dumping, string searches), service discovery across SMB, RDP, SSH, LDAP, RPC, FTP, Telnet and HTTP, WMI and WinRM, using tools such as LOLBins, Covenant, CrackMapExec, Impacket, Netcat, sshuttle, Proxychains, PowerShell ISE, Metasploit, PsExec and Mimikatz.
What to understand
Pivoting uses a compromised host as a route to systems the tester cannot reach directly. Each new host is enumerated for more credentials and trust relationships, so movement compounds. WMI, WinRM and PsExec enable remote execution within Windows environments, and LOLBins keep activity stealthy.
How it shows up
A segmented network and a foothold are described, and you must choose the pivoting or remote-execution technique.
Common confusion
Treating lateral movement as a single step. It is an iterative cycle of enumerate, capture credentials, move, and enumerate again.
5.3 Summarize concepts related to staging and exfiltration.Encryption and compression, covert channels, and exfiltration destinations.
What it means
Staging and exfiltration cover preparing data with file encryption and compression, then moving it out through covert channels such as steganography, DNS, ICMP and HTTPS tunneling, or through email, cross-account resources, cloud storage, alternate data streams, text storage sites and virtual drive mounting.
What to understand
Covert channels hide data in protocols that defenders may not inspect. DNS and ICMP tunneling can slip past controls focused on web traffic, and HTTPS blends with normal encrypted traffic. Encryption and compression reduce size and hide content. During a test, exfiltration is simulated to demonstrate the risk, not to cause real harm.
How it shows up
A monitored environment is described, and you must choose the exfiltration channel most likely to evade the stated controls.
Common confusion
Assuming exfiltration always uses obvious channels. DNS and ICMP tunneling are common precisely because they are often unmonitored.
5.4 Explain cleanup and restoration activities.Removing persistence, reverting changes, removing credentials and tools, and preserving artifacts.
What it means
Cleanup returns the environment to its pre-test state: removing persistence mechanisms, reverting configuration changes, removing tester-created credentials, removing tools, spinning down attacker infrastructure, preserving artifacts for the report, and securely destroying collected data.
What to understand
Cleanup is a professional and ethical obligation. Leaving backdoors, accounts or tools behind weakens the client and creates liability. At the same time, artifacts needed as evidence must be preserved, and sensitive client data the tester collected must be securely destroyed once the engagement is complete.
How it shows up
The engagement is ending, and you must choose what to remove, revert, preserve or destroy.
Common confusion
Treating cleanup as optional tidying. It is a required phase, and incomplete cleanup is a serious failing.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Reverse vs. bind shell

    A reverse shell connects out from the target to the tester. A bind shell listens on the target for an inbound connection.

    Remember
    Reverse shells usually bypass inbound firewall rules.
    Tested as
    Persistence and access questions.
    Trap
    Choosing a bind shell when inbound connections are blocked.

  • Valid credentials as persistence

    Reusing legitimate accounts to maintain access.

    Remember
    It is the stealthiest form of persistence because it looks normal.
    Tested as
    Persistence questions.
    Trap
    Preferring noisy backdoors over captured credentials.

  • C2 framework

    Command-and-control infrastructure that manages compromised hosts, such as Covenant or Metasploit.

    Remember
    It coordinates persistence and tasking.
    Tested as
    Persistence questions.
    Trap
    Confusing a C2 framework with a single backdoor.

  • Pivoting

    Using a compromised host as a route to otherwise unreachable systems.

    Remember
    Proxychains, sshuttle and Metasploit routing enable it.
    Tested as
    Lateral movement questions.
    Trap
    Trying to reach internal hosts directly from outside.

  • Iterative enumeration

    Re-enumerating each new host for credentials and trust before moving on.

    Remember
    Lateral movement compounds through repeated enumeration.
    Tested as
    Lateral movement questions.
    Trap
    Treating movement as a single hop.

  • WMI, WinRM and PsExec

    Windows mechanisms for remote command execution.

    Remember
    They enable lateral movement using valid credentials.
    Tested as
    Remote execution questions.
    Trap
    Overlooking built-in remote execution in favor of exploits.

  • LOLBins

    Trusted built-in binaries used for malicious actions to evade detection.

    Remember
    They keep lateral movement stealthy.
    Tested as
    Evasion questions.
    Trap
    Expecting custom malware when built-in tools suffice.

  • DNS and ICMP tunneling

    Hiding data inside DNS queries or ICMP packets to exfiltrate past controls.

    Remember
    They evade monitoring focused on web traffic.
    Tested as
    Exfiltration questions.
    Trap
    Assuming only HTTP or HTTPS is used for exfiltration.

  • Steganography

    Hiding data inside other files such as images.

    Remember
    It conceals the existence of the data, not just its content.
    Tested as
    Covert channel questions.
    Trap
    Confusing it with encryption, which hides content but not existence.

  • Alternate data streams

    Hidden NTFS streams that can conceal data or code on Windows.

    Remember
    They are easy to miss without specific tools.
    Tested as
    Staging questions.
    Trap
    Overlooking them on Windows file systems.

  • Cleanup obligation

    Removing persistence, accounts, tools and changes at the end of the engagement.

    Remember
    It is a required, ethical phase, not optional tidying.
    Tested as
    Cleanup questions.
    Trap
    Leaving backdoors or accounts behind.

  • Artifact preservation vs. data destruction

    Keep evidence needed for the report, but securely destroy sensitive client data collected during the test.

    Remember
    Both happen at cleanup, for different materials.
    Tested as
    Restoration questions.
    Trap
    Destroying needed evidence or retaining sensitive client data.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Reverse shell vs. bind shell

ConceptMeaningKey differenceCommon trap
Reverse shell Target connects outward to the tester's listener Bypasses most inbound firewall rules Not setting up the listener first
Bind shell Target listens for an inbound connection Blocked by inbound firewalls Using it when inbound traffic is filtered

Persistence vs. lateral movement vs. exfiltration

ConceptMeaningKey differenceCommon trap
Persistence Maintaining access to a compromised host Keeps a foothold over time Leaving it in place at cleanup
Lateral movement Spreading access to other systems Expands reach across the network Skipping re-enumeration on new hosts
Exfiltration Moving data out of the environment Demonstrates data loss risk Using an obvious, monitored channel

DNS tunneling vs. ICMP tunneling vs. HTTPS exfiltration vs. steganography

ConceptMeaningKey differenceCommon trap
DNS tunneling Encodes data in DNS queries Evades controls that ignore DNS Assuming DNS is always monitored
ICMP tunneling Hides data in ICMP packets Evades controls focused on TCP or web Forgetting ICMP can carry payloads
HTTPS exfiltration Sends data over encrypted web traffic Blends with normal traffic Assuming encryption alone hides the transfer
Steganography Hides data inside other files Conceals that data exists Confusing it with encryption

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Bind shell behind a firewall

    What candidates pick
    Open a bind shell on a target that sits behind an inbound firewall.
    Why it looks right
    Bind shells are simple to set up.
    Why it's wrong
    Inbound firewall rules block connections to the target's listener. A reverse shell connects outward and usually succeeds.

    Clue to watch for The target is behind a firewall that blocks inbound traffic.

  2. One-hop movement

    What candidates pick
    Move straight to the goal server without re-enumerating the first compromised host.
    Why it looks right
    It seems faster.
    Why it's wrong
    Each host yields credentials and trust that enable the next move. Skipping enumeration misses the path.

    Clue to watch for The target is not directly reachable from the first foothold.

  3. Exfiltrate over HTTP

    What candidates pick
    Send captured data over plain HTTP to an external server.
    Why it looks right
    It is simple and fast.
    Why it's wrong
    Monitored environments often inspect web traffic. DNS, ICMP or HTTPS channels are more likely to evade detection.

    Clue to watch for The environment has DLP or web monitoring.

  4. Skip cleanup

    What candidates pick
    End the engagement once the objectives are met, leaving tools in place.
    Why it looks right
    The testing goal is achieved.
    Why it's wrong
    Leaving backdoors, accounts and tools weakens the client and breaches the engagement terms. Cleanup is mandatory.

    Clue to watch for The question asks what to do at the end of the engagement.

  5. Destroy the evidence

    What candidates pick
    Delete all collected material, including proof needed for the report.
    Why it looks right
    It feels like thorough cleanup.
    Why it's wrong
    Artifacts needed as evidence must be preserved, while only sensitive client data is securely destroyed.

    Clue to watch for The scenario distinguishes report evidence from collected client data.

  6. Noisy backdoor over credentials

    What candidates pick
    Install a conspicuous rootkit when valid captured credentials would maintain access.
    Why it looks right
    A rootkit feels powerful.
    Why it's wrong
    Valid credentials are stealthier and look legitimate, which suits a test that should avoid detection.

    Clue to watch for Stealth is required and credentials are available.

Answer framework

For any Domain 5 post-exploitation scenario, use these steps before answering.

  1. Establish access that matches the environment, choosing a reverse shell when inbound connections are blocked and valid credentials when stealth matters.
  2. Re-enumerate each compromised host for credentials and trust relationships before moving further.
  3. Pivot through established footholds to reach systems that are not directly accessible, using routing or relay tools such as Proxychains or sshuttle.
  4. Exfiltrate through a channel that evades the stated monitoring, such as DNS, ICMP or HTTPS in preference to plain, closely watched web traffic.
  5. At the end, remove every persistence mechanism, account, tool and configuration change, preserve the artifacts the report needs, and securely destroy sensitive client data.

Practice question

A penetration tester has completed all engagement objectives. During the test they created two service accounts, installed a reverse shell as a scheduled task, and copied sensitive client files to an analysis workstation. What must the tester do during cleanup?

Want more like this? The PenTest+ practice test has questions for every domain.

Checklist

0 of 12

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Start with persistence in 5.1 and lock in the reverse-versus-bind shell distinction, which is frequently tested, along with the idea that valid credentials are the quietest persistence. Learn the common mechanisms rather than every tool.

Next, study lateral movement in 5.2 as an iterative cycle: enumerate, capture credentials, pivot, enumerate again. Understand pivoting with Proxychains or sshuttle and remote execution with WMI, WinRM and PsExec. A lab makes this far clearer than reading.

Then cover staging and exfiltration in 5.3, focusing on covert channels. The exam likes DNS and ICMP tunneling because they evade web-focused monitoring, and it contrasts steganography with encryption.

Finally, treat cleanup in 5.4 as a graded, mandatory phase. Candidates commonly underestimate it, yet it produces clear questions about removing accounts and tools, reverting changes, preserving artifacts and destroying client data. Afterwards, revisit Domain 1, since cleanup and artifact handling tie back to the report and engagement terms.

FAQ

How much of PenTest+ PT0-003 is Domain 5?

Post-exploitation and Lateral Movement is 14% of the PT0-003 exam.

What is the difference between a reverse and a bind shell?

A reverse shell connects outward from the target to the tester, usually bypassing inbound firewalls. A bind shell listens on the target for an inbound connection, which firewalls can block.

What is pivoting?

Using a compromised host as a relay to reach systems the tester cannot access directly, routing traffic through the foothold with tools such as Proxychains or sshuttle.

Why are DNS and ICMP used for exfiltration?

Many environments monitor web traffic closely but inspect DNS and ICMP less, so tunneling data through them can evade detection.

Is cleanup really tested?

Yes. Cleanup and restoration is objective 5.4, and the exam treats removing persistence, accounts and tools and destroying client data as a professional obligation.

What is the difference between steganography and encryption?

Encryption hides the content of data. Steganography hides the fact that the data exists at all, by concealing it inside another file.

How does Domain 5 connect to Domain 1?

The artifacts preserved and the cleanup performed here feed the report and satisfy the engagement terms defined in Engagement Management.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 5 knowledge

You have covered persistence, lateral movement, covert exfiltration and cleanup. Test whether you can choose the right post-exploitation technique and finish the engagement cleanly under exam conditions.

Take the PenTest+ practice test Check your PenTest+ readiness

Keep going